Ransom.Win64.NOKO.YPCJNT

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other Details

This Ransomware does the following:

• The following can be changed in the runtime configuration:
  • Directories to avoid
  • File extensions to avoid
  • Ransom note content
  • Ransom note filename
  • Appended extension of encrypted files
• The following can be enabled/disabled in the runtime configuration:
  • Encryption of network shares
  • Delete shadow copies
  • Loading of hidden drives

It accepts the following parameters:

• --file {File Path}→ encrypt selected files
• --dir {Directory Path}→ encrypt selected directories and sub-directories
• --config {Base64 encoded config} → runtime configuration of the sample.

Ransomware Routine

This Ransomware avoids encrypting files found in the following folders:

• windows
• program files
• program files (x86)
• appdata
• programdata
• system volume information

It appends the following extension to the file name of the encrypted files:

• .AWAYOKON

It leaves text files that serve as ransom notes containing the following text:

• {Encrypted Directory}\AWAYOKON-readme.txt
  

It avoids encrypting files with the following file extensions:

• .exe
• .dll
• .ini
• .lnk
• .url